788c437b5b06cf2db4680da90c9ef42204669948ff48ac4540e2d516bc1ddaa5

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692a2b91cc0c8267c92f810844f0c778_JaffaCakes118.html
Size

72KB
MD5

692a2b91cc0c8267c92f810844f0c778
SHA1

a03cabad2a908a17da83e7061546efb5383c17c4
SHA256

788c437b5b06cf2db4680da90c9ef42204669948ff48ac4540e2d516bc1ddaa5
SHA512

53dfa235c2979248d30117ce05c63d38ced03f98808ab0102302c3a70b0c5030d1733d934d3c2000f530717b99f786daddc92521a6e97cc11081c6371ab9327c
SSDEEP

1536:yoSbFrzdp51v1Nc8sMyKMwXJuPZW/0EnY6e/63hglqW1mXPbRff3rL:y51vs8sMyKMwXQ8njmKhAAXPdff3rL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4136	msedge.exe
4136	msedge.exe
1796	msedge.exe
1796	msedge.exe
556	identity_helper.exe
556	identity_helper.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1796 wrote to memory of 2280	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 2280	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 1196	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4136	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4136	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe
PID 1796 wrote to memory of 4904	1796	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\692a2b91cc0c8267c92f810844f0c778_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
2⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
2⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
2⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11962649998739605213,6462414616207563576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6884 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
fbc119505a25d9c2a0563d36bfd0fe63

SHA1
116d580f0ca2b05e4d59c6c89df8d729346a8fda

SHA256
bd20fbc29b7e51bc009fa111e9b908fa6b15838f0f67dfaddc87c3ac1a90396c

SHA512
fc0edd4f69032243fb30481cb6fcc8180d57d1e301dbf783c5a8667df4177a986c3965f639564aff3d81313a83b9137fb3e8409955627c1e66c812e6dc02b223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e6b0f45e689206c442cecee372ce25bb

SHA1
0e8d64dcd8c7f100501f18312689580f2d42532a

SHA256
d65264f855dadc7f094f6985ced423ba12e392bb53fb20aa0348886e59db38e1

SHA512
31adba25b97eaf6450f23e7be0fcdfda8337477b876b325b7ab4fbf408b435211301355eb84e073c24de61327011c4f2a0b197a1c551790b0dda2808a385a885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
725cb01dc53736364998a56e91f07631

SHA1
ad33b5ad91d71121905c7ae19180bcd99851412c

SHA256
717df0006d7f6dad19324934cacd98aaa7ad263464d2a3cb6656d5e71e5f9bcd

SHA512
5fadad0b277029053f10f5d389a7368e9249ee9c290e1b54784aa894e917aa6dadf79e655c14631ee8d7f56c3aa68f5d166f0d7dbcd36a8a9dbde01207f9bb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cab99df9d1cad2acc65d79a03dc8cd2

SHA1
3238e72bcd245baaf7a47697c79d87aa6b6757fc

SHA256
8f50ad02be91bcceb877127e4b97f2edb05c9f32d288783c244e4ce6635a9b20

SHA512
ff556ba68ea06329a58efbf85f3555fa70a2031cacd4b5feda63a45b0db9c3dc4472ddbd3a967bc96e00a7354bf01021d4d9b3937bacf0747188633c2b5b561f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afbd22c4a7c64ff33646bdcdc0436d45

SHA1
c9b3f42402f22ac202127c2c9650952a887d1868

SHA256
d7ba5badd7226c703bd6fc1101bf6735ee0a871ce4e9cdcebe51dd67eafb3810

SHA512
e9024401479872a69a2bf7429248c1a291de1a388f4c37c62f3de76e3caadc62140bb2ecb809e20d382138d16db3b0884387cfd06772b5973dc450330ef54adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50e4da88756bc69f0e92681681033602

SHA1
02064c6bfb30c37d44159774e32beaef977d067d

SHA256
2e3183c3b984dcd2278d31edaa32c113afe8bead99003304b32d19f32cdbcdea

SHA512
251d96d00f047631b2e38b542b60eca263e25261670ce7a825ac3eb81393cfad2e7f599c59b21831d9a3c5bf33f6a967a9038a2e7fbb41d95818283f9a4d9e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c9be575d30d60bcac8e9b97a43d5ca15

SHA1
f978a74a0531200599807b5c264aedc2b159a80e

SHA256
50de9175ed75303f130f99798350641c0b67cca75a5c334e272ec8b9e5978433

SHA512
bb7e669bf8bc808f053abf1a453cf59e1104eaf2525090370c47e410adaa20c702765ec217bde24c3e2903338b8b736c6db228f9929680c95e184232202c5a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
efce9022882dd154d572d6e2098b2c61

SHA1
38463ea0ea2b91ccd7ac664aec59881ed0ec4202

SHA256
e1f27a53ecc7c05c27d6afdb8353056b6d4c2b396e4947231e40d0a9eba3d17d

SHA512
f5be8631128baea64a3faaf0c07d28a82f7811c2faed263353ba6a4a80a2efa568910ad048160ac5071e63f7d97b63f5ffce7e2a27e50b487d39ca9e7a231218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
9656a8b325f72de97e1565e38e01d8f0

SHA1
3977f59ef45e922bab2b13816714a44143a707e4

SHA256
0a62bf7f6c8166cc789f342387c1e20aabe2157a06c79925f93b2189506a3357

SHA512
e9938f1fd30845c3d3d376926d21f80229aaa57eb8d447fa5c032cbe736c7208eb53ac0222244ce42e4cabef49a5a341d0edbe2f0cdfb377d8a3c3441f5f0ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9a7.TMP

Filesize
203B

MD5
11148745910cf979ccd5fd3e2bf8ee01

SHA1
24d074ab90912703c6d29729b0d6faddf9697640

SHA256
b92b1828cd2b7af65f537c1ce341a9502fe44d9d40307e83ca3493c3c4daec96

SHA512
65be2a0752ffd6767ef7ce5467d7259197a83a10ec6d35cd2631d0d7681661993c045ede1458b9dff1d5025490cfa3e99809bf6e2dfc04a7335b7d9a56fc8030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28999d63c65e3486caba213b1db5543c

SHA1
1ce38b447ba69381393a5bcdf4500b7b37e1a97a

SHA256
630712b22b9caef38c01b4fbbe64a28cef6f75c5b9855a2794681a8461c4cc9f

SHA512
76bea22161c8359543c62b5ca6c8a15373a23d19fbaaa0409daa858d8b5f723bd4b12b52b6aa97d21ceabc3207d38dd7b0aaf007c6df9de4dca4924dffc19b02

Download Submit
\??\pipe\LOCAL\crashpad_1796_SSOBMXTQLMDETCME

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit